Summary
Virtualization is a powerful technology whose security posture can be augmented thanks to SELinux. With sVirt, the open source community has a powerful approach to isolate guests and ensure virtual machines are only able to access the resources they should.
In this chapter, we looked at virtualization and the risks associated with it. We discussed how some of these risks can be mitigated through the same set of controls that SELinux offers, such as type enforcement (limiting what guests can do) and MCS confinement (isolating guests from each other).
We then covered how libvirt supports several virtualization technologies on Linux platforms and how it includes a technology called sVirt that enables SELinux integration, offering guest isolation and access controls. We saw how administrators can manipulate the sVirt logic within libvirt, such as through different domain labels or category sets. We finished the chapter with information on how to use Vagrant with libvirt.
...
